Atomic Edge analysis of CVE-2025-69305 (metadata-based):
This vulnerability is an unauthenticated SQL injection in the Crete Core WordPress plugin, affecting versions up to and including 1.4.3. The flaw allows attackers to execute arbitrary SQL commands by manipulating a user-supplied parameter. The CVSS score of 7.5 (High) reflects a network-based attack requiring no privileges or user interaction.

Atomic Edge research infers the root cause is improper neutralization of special elements in an SQL command (CWE-89). The description cites insufficient escaping and lack of query preparation. This indicates the plugin likely constructs SQL queries by directly concatenating user input into the query string. The vulnerable code path is not confirmed via source review, but the CWE classification strongly suggests the use of insecure functions like `$wpdb->query()` with unescaped variables, or direct MySQLi calls without parameterization.

The exploitation method is an unauthenticated HTTP request to a plugin endpoint. Attackers can inject SQL payloads via a specific parameter. Based on WordPress plugin patterns, the likely vector is a public AJAX handler (`wp_ajax_nopriv_`) or a REST API endpoint that does not enforce authentication. An attacker would send a POST or GET request containing a malicious SQL payload in a parameter like `id` or `slug`. A UNION-based payload could extract data from the WordPress database.

Remediation requires implementing proper input validation and using prepared statements. The plugin must replace direct string concatenation in SQL queries with parameterized queries via `$wpdb->prepare()`. All user-supplied data used in database operations must be sanitized and validated. The fix should also include capability checks for any administrative actions, though the unauthenticated nature suggests such checks were entirely absent.

Successful exploitation leads to full compromise of the database’s confidentiality. Attackers can extract sensitive information including hashed user passwords, personal data, and authentication cookies. This data can facilitate site takeover, privilege escalation, or lateral movement within the host environment. The impact is limited to information disclosure (C:H/I:N/A:N) as described in the CVSS vector.